Rohit Kumar
Founder, O3 Security
Security researcher with multiple CVE credits, including CVE-2024-9145 in Wiz's VS Code extension. 3x Black Hat Arsenal presenter. Former Meta security engineer.
Writing (21)
- Blog · Oct 21, 2026php2shell (CVE-2026-109618, CVE-2026-109619): How Two PHP Engine Bugs Put 69% of the Web at Risk
Two PHP engine bugs, CVSS 9.2 each, give unauthenticated RCE before your code runs. The mechanism, the SAPI split, and why 34.8% of PHP sites run branches with no official fix.
- Blog · Oct 21, 2026PHP's Now-Patched Critical RCEs (CVE-2026-109618, CVE-2026-109619): What's Confirmed and What Isn't
Two critical PHP flaws, CVSS 9.2 each, leaked before PHP's October 21 fix shipped. What PHP has confirmed, what's still researcher-reported, and what to do now.
- Blog · Oct 21, 2026The eMudhra CA Key Compromise: How Eight Weak Keys Broke Trust Across the Internet
Eight eMudhra intermediate CA keys turned out to be small integers, not random 384-bit numbers. Here's the real timeline, the math, and who had to scramble.
- Blog · Aug 29, 2026TeamPCP Supply Chain Attack: How a Stolen GitHub Token Backdoored Trivy and LiteLLM, and Got Its Operators Arrested
One stolen GitHub Actions token. Weeks later, five poisoned ecosystems in five days. Here's the full attack chain behind TeamPCP, and how OSINT led to two arrests.
- Academy · Aug 24, 2026QBOM vs CBOM: What's the Actual Difference?
QBOM isn't a rival to CBOM, it's a CBOM with a quantum-risk layer on top. The mechanics, plus what SEBI, RBI, NIST, and EO 14412 actually require.
- Academy · Aug 21, 2026Software Supply Chain Attack Statistics 2026, Mapped to the BOM That Catches Each One
Real 2026 supply-chain attack data, mapped to which specific bill of materials, SBOM, CBOM, AIBOM, QBOM, or HBOM, would have actually caught it.
- Academy · Aug 21, 2026AI Model Supply Chain Security: Your AIBOM Needs to Cover the Model, Not Just the Code
Why AI supply chain security is bigger than vulnerable code: model weights, registry impersonation, and provenance are the parts most teams still don't track.
- Academy · Aug 21, 2026The Crypto Agility Maturity Model: 5 Levels, and Where Most Teams Actually Sit
A practical 5-level maturity model for crypto agility, what separates each level, and how it lines up with the four-tier model NIST sketches in CSWP 39.
- Academy · Aug 17, 2026Runtime Reachability Beyond eBPF
eBPF is a strong runtime reachability primitive where you can reach the kernel. Here's what to do on the compute where you can't.
- Blog · Aug 11, 2026Malicious npm and PyPI Packages Impersonate Aerodrome Finance and Ethereum Vault Connector to Steal Developer Credentials
8 npm and PyPI packages impersonate Aerodrome Finance and Euler's Ethereum Vault Connector, then steal .npmrc and SSH keys via webhook.site.
- Academy · Aug 8, 2026What Is a QBOM? The Quantum Bill of Materials, Explained
What a Quantum Bill of Materials is, how it differs from a CBOM, and why it's the inventory behind every post-quantum migration plan.
- Academy · Aug 8, 2026What Is an HBOM? The Hardware Bill of Materials, Explained
What a Hardware Bill of Materials inventories, and why Spectre and Meltdown-class flaws live below what software scanners see.
- Blog · Aug 4, 2026Keyv npm Supply Chain Attack: Inside the Shai-Hulud Worm That Hit 2 Billion Monthly Installs
One maintainer account fell. Hours later a self-propagating worm had poisoned 400+ npm packages, starting from a release with a valid provenance signature.
- Academy · Aug 4, 2026Static Reachability Analysis: How Call Graphs Actually Get Built
How static reachability analysis builds call graphs, resolves symbols, and proves an execution path from entry point to vulnerable function, or fails to.
- Blog · Aug 3, 2026What Is Reachability Analysis? Why "Vulnerable" Doesn't Mean "Exploitable"
Reachability analysis determines whether your code can actually execute a vulnerable function. How static and runtime answer that, and where both fall short.
- Academy · Jun 28, 2026AIBOM vs SBOM: What's the Difference and Why You Need Both
An SBOM lists your software packages. An AIBOM lists your models, datasets, and AI API calls. Here is where the line sits and why you need both.
- Blog · Jun 8, 20265 Malicious PyPI Packages Found Stealing Credentials via Hidden .pth Files (Miasma Campaign)
Five PyPI packages hide malware in .pth files. The payload runs on every Python startup, steals credentials, and hides itself with a one-shot guard.
- Academy · Jun 8, 2026Securing Your Container Supply Chain: SBOM, Cosign Signing, and SLSA Provenance in One Pipeline
Generate an SBOM, sign with cosign, attach SLSA provenance, and enforce with Kyverno. One GitHub Actions pipeline.
- Academy · Jun 7, 2026What Is an AIBOM? The AI Bill of Materials, Explained
What an AI Bill of Materials is, what it inventories, how to generate one, and why the EU AI Act's documentation rules are driving it.
- Academy · Jun 7, 2026What Is an SBOM? A Complete Guide to the Software Bill of Materials
What a software bill of materials is, what goes in one, how to generate it, SPDX vs CycloneDX, and the regulations that now require it.
- Academy · Jun 7, 2026Cryptographic Bill of Materials (CBOM): What It Is and the Tools to Build One
What a CBOM is, what it inventories, why it matters before the 2030 quantum deadlines, and the tools that generate one.